CVE-2026-61443

EUVD-2026-44645
PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() that executes scripts without path containment validation. Attackers can supply absolute file paths to execute arbitrary scripts from any filesystem location, including those outside the intended working directory.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c44f-37qr-gw3f
https://www.vulncheck.com/advisories/praisonai-before-remote-code-execution-via-skilltools
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c44f-37qr-gw3f